Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
37 results
Sep 2, 2026Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect baCVE-2026-84667 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 7.1
Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attackers to redirect backup writes to an attacker-specified directory and to include arbitrary files from the Jenkins controller file system in backups.
- Product
- Jenkins ThinBackup Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2026The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0.CVE-2025-66172 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.1
The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and have access to specific APIs can restore a volume from any other user's backups and attach the volume to their own VMs. Backup plugin users using CloudStack 4.21.0.0+ are recommended to upgrade to CloudStack version 4.22.0.1, which fixes this issue.
- Product
- Apache CloudStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
May 8, 2026The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0.CVE-2025-66171 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and have access to specific APIs can create new VMs using backups of any other user of the environment. Backup plugin users using CloudStack 4.21.0.0+ are recommended to upgrade to CloudStack version 4.22.0.1, which fixes this issue.
- Product
- Apache CloudStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
May 8, 2026The CloudStack Backup plugin has an improper authorization logic in versions 4.21.0.0 and 4.22.0.0.CVE-2025-66170 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
The CloudStack Backup plugin has an improper authorization logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and has access to specific APIs can list backups from any account in the environment. This vulnerability does not allow them to see the contents of the backup. Users are recommended to upgrade to version 4.22.0.1, which fixes the issue.
- Product
- Apache CloudStack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
May 1, 2026Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid: Unauthorized modification of dataCVE-2026-3143 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_cli_cancel' function in all versions up to, and including, 1.17.1. This makes it possible for unauthenticated attackers to cancel a pending rollback, potentially preventing a WordPress installation from automatically reverting a failed update.
- Product
- Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
- Affected
- up to 1.17.1
- What to do
- Affects up to 1.17.1. Update Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 17, 2025Bludit versions before 3.13.1 contain an authenticated file download vulnerability in the Backup Plugin that allows logged-in users to access arbitrary files.CVE-2023-53907 · Other software · Bludit · reported by VulnCheckHigh 7.1
Bludit versions before 3.13.1 contain an authenticated file download vulnerability in the Backup Plugin that allows logged-in users to access arbitrary files. Attackers can exploit the plugin's download functionality by manipulating file path parameters to read sensitive system files through directory traversal.
- Product
- Backup Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbludit.comexploit-db.com
Jul 12, 2025Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid: Sensitive Information ExposureCVE-2020-36848 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.14.9 via the env-info.php and restore-info.json files. This makes it possible for unauthenticated attackers to find the location of back-up files and subsequently download them.
- Product
- Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
- Affected
- up to 1.14.9
- What to do
- Affects up to 1.14.9. Update Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgraw.githubusercontent.com
Mar 26, 2025Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid: Remote Code ExecutionCVE-2025-2257 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.16.10 via the compression_level setting. This is due to the plugin using the compression_level setting in proc_open() without any validation. This makes it possible for authenticated attackers, with administrator-level access and above, to execute code on the server.
- Product
- Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
- Affected
- up to 1.16.10
- What to do
- Affects up to 1.16.10. Update Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.svn.wordpress.org
Feb 27, 2025Arbitrary file overwrite during home directory recovery due to improper symbolic link handling.CVE-2025-24832 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Arbitrary file overwrite during home directory recovery due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.8.4.866, Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.1.892, Acronis Backup extension for Plesk (Linux) before build 1.8.7.615.
- Product
- Acronis Backup plugin for cPanel & WHM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.com
Feb 27, 2025Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid: Server-Side Request ForgeryCVE-2024-13907 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.16.8 via the 'download' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Product
- Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
- Affected
- up to 1.16.8
- What to do
- Affects up to 1.16.8. Update Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 26, 2024Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid: Remote Code ExecutionCVE-2024-9461 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.16.6 via the cron_interval parameter. This is due to missing input validation and sanitization. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.
- Product
- Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
- Affected
- up to 1.16.6
- What to do
- Affects up to 1.16.6. Update Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Nov 11, 2024Sensitive information disclosure during file browsing due to improper symbolic link handling.CVE-2024-34015 · Other software · Acronis · reported by security@acronis.comLow 3.3
Sensitive information disclosure during file browsing due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.8.3.818, Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.1.892.
- Product
- Acronis Backup plugin for cPanel & WHM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.com
Nov 11, 2024Arbitrary file overwrite during recovery due to improper symbolic link handling.CVE-2024-34014 · Other software · Acronis · reported by security@acronis.comMedium 5.5
Arbitrary file overwrite during recovery due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.8.3.818, Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.1.892, Acronis Backup extension for Plesk (Linux) before build 1.8.6.599, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.2.181.
- Product
- Acronis Backup plugin for cPanel & WHM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.com
Sep 17, 2024Sensitive data disclosure and manipulation due to unnecessary privileges assignment.CVE-2024-8767 · Other software · Acronis · reported by security@acronis.comCritical 9.9
Sensitive data disclosure and manipulation due to unnecessary privileges assignment. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 619, Acronis Backup extension for Plesk (Linux) before build 555, Acronis Backup plugin for DirectAdmin (Linux) before build 147.
- Product
- Acronis Backup plugin for cPanel & WHM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity-advisory.acronis.com
May 29, 2024WP STAGING WordPress Backup Plugin – Migration Backup Restore: Arbitrary file uploadsCVE-2024-3412 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The WP STAGING WordPress Backup Plugin – Migration Backup Restore plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wpstg_processing AJAX action in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- Product
- WP STAGING WordPress Backup Plugin – Migration Backup Restore
- Affected
- up to 3.4.3
- What to do
- Affects up to 3.4.3. Update WP STAGING WordPress Backup Plugin – Migration Backup Restore to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Apr 17, 2024WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro: Does not sanitise and escape some of its settingsCVE-2024-2309 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro WordPress plugin before 5.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro
- Fixed in
- 3.4.0
- What to do
- Update WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro to 3.4.0 or newer.
Jan 29, 2024The WP STAGING WordPress Backup plugin before 3.2.0 allows access to cache files during the cloning process which providesCVE-2023-7204 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP STAGING WordPress Backup plugin before 3.2.0 allows access to cache files during the cloning process which provides
- Product
- WP STAGING WordPress Backup
- Fixed in
- 3.2.0
- What to do
- Update WP STAGING WordPress Backup to 3.2.0 or newer.
Jan 1, 2024The WP STAGING WordPress Backup Plugin before 3.1.3 and WP STAGING Pro WordPress Backup Plugin before 5.1.3 do not prevent visitors from leaking key informationCVE-2023-6113 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP STAGING WordPress Backup Plugin before 3.1.3 and WP STAGING Pro WordPress Backup Plugin before 5.1.3 do not prevent visitors from leaking key information about ongoing backups processes, allowing unauthenticated attackers to download said backups later.
- Product
- WP STAGING WordPress Backup
- Fixed in
- 3.1.3
- What to do
- Update WP STAGING WordPress Backup to 3.1.3 or newer.
Full record and what to do →NVD recordresearch.cleantalk.orgwpscan.com
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in Prashant Walke WP All Backup plugin <= 2.4.3 versions.CVE-2023-32583 · WordPress plugins & themes · reported by PatchstackMedium 6.3
Cross-Site Request Forgery (CSRF) vulnerability in Prashant Walke WP All Backup plugin <= 2.4.3 versions.
- Affected
- up to 2.4.3
- What to do
- Affects up to 2.4.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in UpdraftPlus.Com, DavidAnderson UpdraftPlus WordPress Backup Plugin <= 1.23.3 versions leads to sitewide CrossCVE-2023-32960 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in UpdraftPlus.Com, DavidAnderson UpdraftPlus WordPress Backup Plugin <= 1.23.3 versions leads to sitewide Cross-Site Scripting (XSS).
- Affected
- up to 1.23.3
- What to do
- Affects up to 1.23.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 27, 2022A missing permission check in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers with Overall/Read permission to request a manual backup.CVE-2022-36917 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
A missing permission check in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers with Overall/Read permission to request a manual backup.
- Product
- Jenkins Google Cloud Backup Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jul 27, 2022A cross-site request forgery (CSRF) vulnerability in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers to request a manual backup.CVE-2022-36916 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 8
A cross-site request forgery (CSRF) vulnerability in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers to request a manual backup.
- Product
- Jenkins Google Cloud Backup Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jun 27, 2022The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its settings, leading to maliCVE-2022-1028 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)
- Product
- WordPress Security Firewall, Malware Scanner, Secure Login and Backup
- Fixed in
- 4.2.1
- What to do
- Update WordPress Security Firewall, Malware Scanner, Secure Login and Backup to 4.2.1 or newer.
May 11, 2022An issue was found in bludit v3.13.0, unsafe implementation of the backup plugin allows attackers to upload arbitrary files.CVE-2020-19228 · Other software · Bludit · reported by MITREHigh 7.2
An issue was found in bludit v3.13.0, unsafe implementation of the backup plugin allows attackers to upload arbitrary files.
- Product
- Bludit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2021bludit v3.13.0 contains an arbitrary file deletion vulnerability in the backup plugin via the `deleteBackup' parameter.CVE-2020-20495 · Other software · Bludit · reported by MITRECritical 9.1
bludit v3.13.0 contains an arbitrary file deletion vulnerability in the backup plugin via the `deleteBackup' parameter.
- Product
- Bludit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2020The WP Database Backup plugin through 5.5 for WordPress stores downloads by default locally in the directory wp-content/uploads/db-backup/.CVE-2020-7241 · WordPress plugins & themes · reported by MITREHigh 7.5
The WP Database Backup plugin through 5.5 for WordPress stores downloads by default locally in the directory wp-content/uploads/db-backup/. This might allow attackers to read ZIP archives by guessing random ID numbers, guessing date strings with a 2020_{0..1}{0..2}_{0..3}{0..9} format, guessing UNIX timestamps, and making HTTPS requests with the complete guessed URL.
- Product
- WP Database Backup
- Affected
- up to 5.5
- What to do
- Affects up to 5.5. Update WP Database Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comwordpress.org
Aug 12, 2019The wp-database-backup plugin before 5.1.2 for WordPress has XSS.CVE-2019-14949 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-database-backup plugin before 5.1.2 for WordPress has XSS.
- Product
- wp-database-backup
- Fixed in
- 5.1.2
- What to do
- Update wp-database-backup to 5.1.2 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 12, 2019The wp-database-backup plugin before 4.3.1 for WordPress has CSRF.CVE-2016-10876 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-database-backup plugin before 4.3.1 for WordPress has CSRF.
- Product
- wp-database-backup
- Fixed in
- 4.3.1
- What to do
- Update wp-database-backup to 4.3.1 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 12, 2019The wp-database-backup plugin before 4.3.1 for WordPress has XSS.CVE-2016-10875 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-database-backup plugin before 4.3.1 for WordPress has XSS.
- Product
- wp-database-backup
- Fixed in
- 4.3.1
- What to do
- Update wp-database-backup to 4.3.1 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 12, 2019The wp-database-backup plugin before 4.3.3 for WordPress has CSRF.CVE-2016-10874 · WordPress plugins & themes · reported by MITREHigh 8.8
The wp-database-backup plugin before 4.3.3 for WordPress has CSRF.
- Product
- wp-database-backup
- Fixed in
- 4.3.3
- What to do
- Update wp-database-backup to 4.3.3 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Aug 12, 2019The wp-database-backup plugin before 4.3.3 for WordPress has XSS.CVE-2016-10873 · WordPress plugins & themes · reported by MITREMedium 6.1
The wp-database-backup plugin before 4.3.3 for WordPress has XSS.
- Product
- wp-database-backup
- Fixed in
- 4.3.3
- What to do
- Update wp-database-backup to 4.3.3 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Oct 5, 2018The wp-db-backup plugin 2.2.4 for WordPress relies on a five-character string for access control, which makes it easier for remote attackers to read backup archCVE-2014-10076 · WordPress plugins & themes · reported by MITREHigh 7.5
The wp-db-backup plugin 2.2.4 for WordPress relies on a five-character string for access control, which makes it easier for remote attackers to read backup archives via a brute-force attack.
- Affected
- 2.2.4 to 2.2.4
- What to do
- Affects 2.2.4 to 2.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordvapidlabs.comvapidlabs.com
Oct 4, 2017The Periodic Backup Plugin did not perform any permission checks, allowing any user with Overall/Read access to change its settings, trigger backups, restore baCVE-2017-1000086 · Websites & servers · Jenkins · reported by MITREHigh 8
The Periodic Backup Plugin did not perform any permission checks, allowing any user with Overall/Read access to change its settings, trigger backups, restore backups, download backups, and also delete all previous backups via log rotation. Additionally, the plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks.
- Product
- Periodic Backup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comjenkins.io
Dec 31, 2014Directory traversal vulnerability in download.php in the DB Backup plugin 4.5 and earlier for Wordpress allows remote attackers to read arbitrary files via a ..CVE-2014-9119 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in download.php in the DB Backup plugin 4.5 and earlier for Wordpress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
- Product
- DB Backup
- Affected
- up to 4.5
- What to do
- Affects up to 4.5. Update DB Backup to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordseclists.orgexchange.xforce.ibmcloud.com
Feb 12, 2013Cross-site scripting (XSS) vulnerability in lazyest-backup.php in the Lazyest Backup plugin before 0.2.2 for WordPress allows remote attackers to inject arbitraCVE-2011-5264 · WordPress plugins & themes · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in lazyest-backup.php in the Lazyest Backup plugin before 0.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the xml_or_all parameter.
- Product
- Cross-site scripting (XSS) vulnerability in lazyest-backup.php in the Lazyest Backup
- Fixed in
- 0.2.2
- What to do
- Update Cross-site scripting (XSS) vulnerability in lazyest-backup.php in the Lazyest Backup to 0.2.2 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgsecunia.com
Jan 20, 2012Directory traversal vulnerability in meb_download.php in the myEASYbackup plugin 1.0.8.1 for WordPress allows remote attackers to read arbitrary files via a ..CVE-2012-0898 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in meb_download.php in the myEASYbackup plugin 1.0.8.1 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the dwn_file parameter.
- Product
- myEASYbackup
- What to do
- Update myEASYbackup to the newest version.
Full record and what to do →NVD recordpacketstormsecurity.orgsecunia.com
Aug 17, 2006wp-db-backup.php in Skippy WP-DB-Backup plugin for WordPress 1.7 and earlier: Directory traversalCVE-2006-4208 · WordPress plugins & themes · reported by MITREMedium 5
Directory traversal vulnerability in wp-db-backup.php in Skippy WP-DB-Backup plugin for WordPress 1.7 and earlier allows remote authenticated users with administrative privileges to read arbitrary files via a .. (dot dot) in the backup parameter to edit.php.
- Product
- wp-db-backup.php in Skippy WP-DB-Backup plugin for WordPress 1.7 and earlier
- Affected
- up to 1.7
- What to do
- Affects up to 1.7. Update wp-db-backup.php in Skippy WP-DB-Backup plugin for WordPress 1.7 and earlier to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.